AI Policy

Brussels Moves to Vet AI Before It Reaches You

On 7 July 2026 the European Commission set out an Action Plan that will build an EU capacity to evaluate advanced AI before it reaches the market, plus a state-run secure testing platform for critical sectors. For operators, which AI you can deploy becomes partly a regulator's call.

AI PolicyBy Servola Tech Desk2026-07-103 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Brussels Moves to Vet AI Before It Reaches You

Key takeaways

On 7 July 2026 the European Commission published an Action Plan on Cybersecurity and AI that will build an EU capacity to evaluate advanced AI models before they reach the EU market, backing the AI Office whose enforcement powers switch on 2 August - so whether a model is allowed here becomes partly a regulator's call, not only the vendor's.
ENISA and the Commission's Joint Research Centre will run a secure platform to test AI for cybersecurity by the end of 2026, aimed at critical sectors - finance, energy, health, transport and public administration - giving operators there a state reference point for what safe AI use means, and an implicit expectation to meet it.
With the US already testing frontier models before release, the model your product depends on may soon need to clear government evaluation on both sides of the Atlantic; map now which of your AI uses fall into high-risk or critical-sector categories, because that is where documentation and evaluation demands will land first.

What Brussels actually put on the table

On 7 July 2026 the European Commission presented its Action Plan on Cybersecurity and Artificial Intelligence, and the part that matters for operators is quiet but structural. The AI Act already requires advanced AI models to be evaluated and their risks assessed before they are placed on the EU market. The Commission now says it will help build an EU evaluation capacity to strengthen independent, third-party assessment of what these models can do and where they are risky, working in direct support of the AI Office - the body whose enforcement powers switch on 2 August 2026.

Alongside that, the EU Agency for Cybersecurity and the Commission's Joint Research Centre will stand up a secure platform to test AI for cybersecurity, using simulated environments, by the end of 2026. The Commission also wants a European blueprint for structured access to advanced AI capabilities for defence. Read together, these are not vague ambitions - they are the machinery for a world in which a model is examined by public bodies before, and after, it reaches the businesses that will run it.

Why this lands on critical-sector operators first

The plan names its first audience plainly: finance, energy, health, transport and public administration. The secure testing platform is built for exactly those operators, so they can see how a model behaves in cybersecurity use before trusting it in production. That is genuinely useful - a state-run place to test AI in a simulated environment is something no single mid-sized operator could build alone. But a reference platform also sets a reference standard, and once one exists, using AI without having checked it against that standard starts to look like a choice you have to defend.

The access question is sharper still. A blueprint for structured access to advanced AI decides who gets to use the strongest models for defence, and on what terms. For a European operator that means the most capable tools may come with conditions attached - vetting, documentation, sector rules - rather than a simple licence. The upside is a shared floor of safety; the cost is that your choice of model in a critical sector is no longer only a procurement decision.

The model you depend on may need two governments' sign-off

Put this beside what is already happening in Washington. The United States now runs its own pre-release testing of frontier models through a dedicated evaluation body, and Europe is now building the same capacity on its side of the Atlantic. A company that builds a product on a leading model could soon find that model has to satisfy evaluators in two jurisdictions before it is cleared for use - and that a delay or a restriction in either one lands on your roadmap, not the vendor's.

The practical move is not to wait for August. Map which of your AI uses touch the high-risk or critical-sector categories the Act cares about, because those are where evaluation, documentation and access conditions arrive first. Know whether the models you rely on are the ones regulators will scrutinise, and keep a fallback in mind. The firms that understand their exposure before the AI Office starts using its powers will adapt on their own schedule; the ones that assume nothing changes until they are told will adapt on someone else's.

Frequently asked questions

What did the European Commission actually announce on 7 July 2026?

An Action Plan on Cybersecurity and Artificial Intelligence. Its key operator-relevant parts are an EU capacity to independently evaluate advanced AI models before they reach the market, a secure platform run by ENISA and the Joint Research Centre to test AI for cybersecurity by the end of 2026, and a planned European blueprint for structured access to the most advanced AI for defence. It supports the AI Office, whose enforcement powers begin on 2 August 2026.

Does this stop me from using a particular AI model?

Not directly or immediately. The plan builds evaluation capacity rather than a ban list. But over time, advanced models placed on the EU market must be evaluated and their risks assessed, and in critical sectors a state testing platform sets an expectation of checking a model before you deploy it. The practical effect is that model choice in high-risk or critical-sector uses becomes partly a compliance question, not only a commercial one.

Which sectors should pay attention first?

Finance, energy, health, transport and public administration - the critical sectors the secure testing platform is explicitly aimed at. If you operate in one of these, or supply software into them, expect evaluation and documentation expectations to reach you earliest. Mapping which of your AI uses fall into the Act's high-risk categories is the concrete first step before the AI Office's powers switch on in August.

Europe is not banning advanced AI; it is inserting itself between the model and the market. For operators in critical sectors, the question is shifting from which model is best to which model has cleared evaluation here. The firms that map that exposure before August will adapt on their own terms. The ones that wait will rework a deployment after the fact.

AI PolicyEuropean CommissionEU AI ActAI OfficeCybersecurityENISACritical infrastructureModel evaluation

China Clears Its Top Labs to Buy Nvidia H200s

Beijing will let Alibaba, ByteDance and DeepSeek buy a capped batch of Nvidia H200s. For European buyers, the cheap Chinese model on your shortlist is about to train on better hardware.

3 min read

AI Policy

The AI Agent Governance Gap: Why Fast Deployment Is Building Tomorrow's Liability

88% of organizations had an AI agent security incident last year. Only 14.4% of agents went live with full IT and security sign-off. Gartner says uniform governance across agents leads to failure. Here is how proportional governance actually works.

2 min read

Digital Sovereignty

The EU Council Revived the Rule That Scans Private Messages

The EU Council revived the lapsed rule that lets providers scan private messages with AI. For owners, confidential communication is now a governance choice.